---
name: "rndc-confgen"
section: "8"
platform: "linux"
package: "bind"
version: "9.20.30-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/rndc-confgen"
---

# rndc-confgen(8)

rndc key generation tool

## NAME

rndc-confgen - rndc key generation tool

## SYNOPSIS

**rndc-confgen** \[**-a**\] \[**-A** algorithm\] \[**-b** keysize\] \[**-c** keyfile\] \[**-h**\] \[**-k** keyname\] \[**-p** port\] \[**-s** address\] \[**-t** chrootdir\] \[**-u** user\]

## DESCRIPTION

**rndc-confgen** generates configuration files for **rndc** \<#std-iscman-rndc\>. It can be used as a convenient alternative to writing the **rndc.conf** \<#std-iscman-rndc.conf\> file and the corresponding **controls** and **key** statements in **named.conf** \<#std-iscman-named.conf\> by hand. Alternatively, it can be run with the **-a** option to set up a **rndc.key** file and avoid the need for a **rndc.conf** \<#std-iscman-rndc.conf\> file and a **controls** statement altogether.

## OPTIONS

- **-a**

  This option sets automatic **rndc** \<#std-iscman-rndc\> configuration, which creates a file **/etc/rndc.key** that is read by both **rndc** \<#std-iscman-rndc\> and **named** \<#std-iscman-named\> on startup. The **rndc.key** file defines a default command channel and authentication key allowing **rndc** \<#std-iscman-rndc\> to communicate with **named** \<#std-iscman-named\> on the local host with no further configuration.

  If a more elaborate configuration than that generated by **rndc-confgen -a** is required, for example if rndc is to be used remotely, run **rndc-confgen** without the **-a** option and set up **rndc.conf** \<#std-iscman-rndc.conf\> and **named.conf** \<#std-iscman-named.conf\> as directed.

- **-A algorithm**

  This option specifies the algorithm to use for the TSIG key. Available choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512. The default is hmac-sha256.

- **-b keysize**

  This option specifies the size of the authentication key in bits. The size must be between 1 and 512 bits; the default is the hash size.

- **-c keyfile**

  This option is used with the **-a** option to specify an alternate location for **rndc.key**.

- **-h**

  This option prints a short summary of the options and arguments to **rndc-confgen**.

- **-k keyname**

  This option specifies the key name of the **rndc** \<#std-iscman-rndc\> authentication key. This must be a valid domain name and will be sanitized using the domain name semantics. The default is **rndc-key**.

- **-p port**

  This option specifies the command channel port where **named** \<#std-iscman-named\> listens for connections from **rndc** \<#std-iscman-rndc\>. The default is 953.

- **-q**

  This option prevets printing the written path in automatic configuration mode.

- **-s address**

  This option specifies the IP address where **named** \<#std-iscman-named\> listens for command-channel connections from **rndc** \<#std-iscman-rndc\>. The default is the loopback address 127.0.0.1.

- **-t chrootdir**

  This option is used with the **-a** option to specify a directory where **named** \<#std-iscman-named\> runs chrooted. An additional copy of the **rndc.key** is written relative to this directory, so that it is found by the chrooted **named** \<#std-iscman-named\>.

- **-u user**

  This option is used with the **-a** option to set the owner of the generated **rndc.key** file. If **-t** is also specified, only the file in the chroot area has its owner changed.

## EXAMPLES

To allow **rndc** \<#std-iscman-rndc\> to be used with no manual configuration, run:

**rndc-confgen -a**

To print a sample **rndc.conf** \<#std-iscman-rndc.conf\> file and the corresponding **controls** and **key** statements to be manually inserted into **named.conf** \<#std-iscman-named.conf\>, run:

**rndc-confgen**

## SEE ALSO

**[rndc(8)](/rndc/8.md)** \<#std-iscman-rndc\>, **[rndc.conf(5)](/rndc.conf/5.md)** \<#std-iscman-rndc.conf\>, **[named(8)](/named/8.md)** \<#std-iscman-named\>, BIND 9 Administrator Reference Manual.

## Author

Internet Systems Consortium

## Copyright

2026, Internet Systems Consortium